Fleet Health & Monitoring

The Fleet Health page in the Admin Dashboard gives a real-time view of all enrolled workstations — which are online, which are running outdated daemons, and which have been silent too long.

Fleet Health Dashboard

Navigate to Fleet Health in the sidebar. The page shows:

• Online — workstations that sent a heartbeat within the last 6 minutes
• Offline — workstations that have not checked in recently
• Outdated — workstations running a daemon version below the org's minDaemonVersion
• Total enrolled — count of all non-revoked workstations

Each row in the workstation table shows:

Column	Description
Hostname	Workstation display name set during enrollment
Status	Online / Offline badge
Daemon version	Reported version from the last heartbeat
CA status	Whether the workstation CA certificate is installed and valid
Last seen	Timestamp of last heartbeat
IP	Last reported IP address

The fleet health summary is also available via the API:

GET /api/v1/organizations/:orgId/workstations/fleet-health

Requires soc_analyst, org_admin, or super_admin role. Returns aggregate counts (online, offline, outdated, unhealthy CA) and the full workstation list with the same fields shown in the dashboard table.

Minimum Daemon Version Enforcement

Set the minimum acceptable daemon version for your organisation:

curl -X PATCH https://your-policy-engine/api/v1/organizations/<orgId>/settings \
  -H "Authorization: Bearer <admin-jwt>" \
  -H "Content-Type: application/json" \
  -d '{ "minDaemonVersion": "2.1.0" }'

Workstations running older versions are flagged as Outdated in the fleet health view. Policy enforcement is not blocked for outdated daemons — the flag is informational; use MDM or the tray app auto-update to push upgrades.

Heartbeat

The proxy daemon sends a heartbeat POST /workstations/:id/heartbeat every 5 minutes by default (configurable via BITDRIP_HEARTBEAT_INTERVAL_MS). The heartbeat payload includes:

{
  "version": "2.2.15",
  "ip": "10.0.1.42",
  "uptime": 3600,
  "paused": false,
  "caStatus": "installed"
}

caStatus values: "installed" (CA cert present and trusted), "missing" (not yet generated or installed), "expired" (CA cert past its validity date).

User Risk Scoring

The Fleet Health section also surfaces the risk ranking of users in your organisation. The risk score is computed as:

score = violationCount × avgConfidence × recencyWeight × 10   (capped at 100)

Where recencyWeight = 1 - (daysAgo / 30) × 0.5 (violations older than 30 days have half the weight).

Risk classifications:

Score	Classification
0–39	Low
40–69	Medium
70–100	High

Access the risk ranking at:

GET /api/v1/organizations/:orgId/users/risk-ranking

Requires soc_analyst, org_admin, or super_admin role.